CVE-2025-13486
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
CRITICAL 9.8EPSS 67.6%
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.
- Affected
- hwk-fr · Advanced Custom Fields: Extended
- CVSS v3.1 WORDFENCE
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 67.62% chance of exploitation in the next 30 days, 99th percentile
- Nuclei
- critical · CWE-94
- Published
- 2025-12-03
Proof-of-concept exploits (5)
- 0xanis/CVE-2025-13486-POC5★ · 2025-12-04
- 0xgh057r3c0n/CVE-2025-134861★ · 2025-12-07
- MataKucing-OFC/CVE-2025-134862★ · 2025-12-05
- lasthero-887/CVE-2025-13486---Poc2★ · 2025-12-03
- whattheslime/CVE-2025-134861★ · 2025-12-19